fix(ci): retry runs that failed before executing any of our code

[catomean]

The gap

The sweep retries CANCELLED checks but deliberately leaves genuine failures alone. A GitHub Actions incident lands exactly in the gap between those two: the run reports conclusion=failure, so it is treated as a real verdict — but it never executed a line of this repo's code.

The consequence is not a slow queue, it is a permanent stall. During an incident every open PR is stranded, and since nobody is in the merge loop, nobody notices.

This is live right now. Actions has been in a major outage since 15:22Z (webhooks throttled to ~15%). Three jobs on #278 died with:

Failed to resolve action download info. Error: Service Unavailable

That PR cannot go green again without a human running gh run rerun --failed — which is precisely the "someone must be watching" assumption this whole auto-merge setup exists to remove.

The discriminator

A job whose only failed step is Set up job never got as far as running our code — GitHub could not resolve an action, provision the runner, or start the container. It produced no verdict about the code. A real failure names a real step.

Verified against live runs in this repo:

Run	Failed steps	Verdict
#278, outage	[Set up job]	infra → retry
#228, TypeScript 7	[Verify (lint + umlauts + typecheck + build)]	real → leave alone
#265, ESLint 10	[Verify (lint + umlauts + typecheck + build)]	real → leave alone
nonexistent run id	no data	refuses to guess

Safety

• Conservative by construction: retries only when every failed job in the run failed at set-up. One real step failure anywhere and the PR is left alone.
• Refuses to guess: if the jobs API returns nothing or is unreachable, it returns "not infra". Guessing the other way would re-run real failures forever.
• Capped at MAX_RUN_ATTEMPTS (default 3). An incident can last hours; an uncapped retry would re-run the same doomed run every 10 minutes indefinitely and bury the real signal.
• Needs no new permissions — actions: write is already granted for the existing cancelled-run retry.

Note on fleet drift

My notes said this script was byte-identical across the fleet. That is no longer true — orangecat 190 lines, fleetcrown 232, evig 208 (evig has #275's oldest-first fix). This change is evig-only and worth porting to the other two, since the failure mode is not evig-specific.

🤖 Generated with Claude Code

[catomean]

Re-firing CI: this PR's pull_request webhook was dropped during the GitHub Actions incident of 2026-08-06 (webhooks throttled to ~15%; GitHub's closing update states the missed events "cannot be replayed automatically"). No workflow run ever existed for head 875e7609, so the auto-merge sweep skipped it indefinitely with no checks reported yet. Closing and reopening replays the event.